fix(auth): use exact timestamp for api key expiry check by TechGenius-Karan · Pull Request #29736 · calcom/cal.diy

TechGenius-Karan · 2026-07-07T08:07:39Z

What does this PR do?

API keys were staying valid for up to 24 hours past their actual expiry. The check was truncating both sides to
midnight using .setHours(0, 0, 0, 0), so a key with expiresAt set to midnight today would compare as
today_midnight > today_midnight = false — accepted as valid all day.

There was also a side effect: .setHours() mutates the Date object in place, so keyData.expiresAt was getting
its time component zeroed after the check ran (this is what the reporter saw when the stored timestamp looked
altered).

Before:

    ```ts
   const isKeyExpired =
     keyData.expiresAt && new Date().setHours(0, 0, 0, 0) > keyData.expiresAt.setHours(0, 0, 0, 0);

After:

```ts
const isKeyExpired = keyData.expiresAt && new Date() > keyData.expiresAt;

exact timestamp comparison — no truncation, no mutation.

Visual Demo (For contributors especially)

not applicable — this is a logic fix in the auth strategy, no UI changes.

Mandatory Tasks (DO NOT REMOVE)

I have self-reviewed the code (A decent size PR without self-review might be rejected).
I have updated the developer docs if this PR makes changes that would require a documentation change. N/A — no
API or config changes.
I confirm automated tests are in place that prove my fix is effective or that my feature works.

added a regression test in api-auth.strategy.e2e-spec.ts — creates a key with expiresAt set 1 second in the
past and asserts apiKeyStrategy throws UnauthorizedException.

How should this be tested?

run the existing e2e suite for the auth strategy:

cd apps/api && yarn test:e2e --testPathPattern=api-auth.strategy

the new test (should throw UnauthorizedException for an api key that expired seconds ago) will fail on the old
code and pass on the fix.

Checklist

Contributing guide has been read.
Change is minimal — 1 line in the strategy, 1 import + 1 test in the spec.
No new warnings introduced.
PR is well under 500 lines and under 10 files.

github-actions · 2026-07-07T08:07:48Z

Welcome to Cal.diy, @TechGenius-Karan! Thanks for opening this pull request.

A few things to keep in mind:

This is Cal.diy, not Cal.com. Cal.diy is a community-driven, fully open-source fork of Cal.com licensed under MIT. Your changes here will be part of Cal.diy — they will not be deployed to the Cal.com production app.
Please review our Contributing Guidelines if you haven't already.
Make sure your PR title follows the Conventional Commits format.

A maintainer will review your PR soon. Thanks for contributing!

coderabbitai · 2026-07-07T08:11:04Z

📝 Walkthrough

Walkthrough

Related PRs: None specified

Suggested labels: None specified

Suggested reviewers: None specified

Changes

This change modifies the API key expiration check in the authentication strategy, replacing a midnight-normalized date comparison with a direct comparison between the current timestamp and the key's expiration timestamp. A corresponding end-to-end test was added to verify that an API key expired just seconds prior is correctly rejected with an UnauthorizedException. The test file's imports were updated to include UnauthorizedException.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant apiKeyStrategy
  Client->>apiKeyStrategy: request with expired API key
  apiKeyStrategy->>apiKeyStrategy: compare new Date() to keyData.expiresAt
  apiKeyStrategy-->>Client: throw UnauthorizedException

Poem
A rabbit checks the clock with care,
No more midnight math to spare,
Seconds count, the key's expired,
UnauthorizedException fired,
Tests confirm the fix is fair! 🐰⏰

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address `#29728` by using exact timestamp comparison, avoiding mutation, and adding a rejection test.
Out of Scope Changes check	✅ Passed	The PR stays focused on the API key expiry bug fix and regression test with no unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly summarizes the auth change to exact API key expiry timestamp checks.
Description check	✅ Passed	The description directly explains the expiry bug, the timestamp fix, and the regression test.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-15T00:33:55Z

This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active.

TechGenius-Karan · 2026-07-15T08:39:53Z

I updated the branch to keep this PR active

github-actions · 2026-07-23T00:40:40Z

This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active.

CLAassistant · 2026-07-23T03:47:01Z

All committers have signed the CLA.

TechGenius-Karan · 2026-07-23T09:18:25Z

This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active.

I updated this branch again to keep this PR active. Could any of the maintainers please review this PR and get it merged.

fix(auth): use exact timestamp for api key expiry check

4da4961

pull-request-size Bot added the size/S label Jul 7, 2026

github-actions Bot added the 🐛 bug Something isn't working label Jul 7, 2026

github-actions Bot added the Stale label Jul 15, 2026

Merge branch 'main' into fix/expired-api-key-timestamp-check-29728

d8c3448

github-actions Bot removed the Stale label Jul 16, 2026

github-actions Bot added the Stale label Jul 23, 2026

Merge branch 'main' into fix/expired-api-key-timestamp-check-29728

85613ec

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(auth): use exact timestamp for api key expiry check#29736

fix(auth): use exact timestamp for api key expiry check#29736
TechGenius-Karan wants to merge 3 commits into
calcom:mainfrom
TechGenius-Karan:fix/expired-api-key-timestamp-check-29728

TechGenius-Karan commented Jul 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

TechGenius-Karan commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

CLAassistant commented Jul 23, 2026 •

edited

Loading

Uh oh!

TechGenius-Karan commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

TechGenius-Karan commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Visual Demo (For contributors especially)

Mandatory Tasks (DO NOT REMOVE)

How should this be tested?

Checklist

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

coderabbitai Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

TechGenius-Karan commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

CLAassistant commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TechGenius-Karan commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

TechGenius-Karan commented Jul 7, 2026 •

edited

Loading

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

CLAassistant commented Jul 23, 2026 •

edited

Loading